Vulnerability PYSEC-2026-2392
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
July 13, 2026 at 03:46 PM UTC
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
2.3.1 - 2.8.4.7578rc0
2.3.1 - 2.8.4.7578rc0
Summary
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
Details
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
10 hours ago
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
Low Risk
3 months ago
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
Medium Risk
3 months ago
BBOT: Arbitrary File Write in postman_download Module
2.1.0 - 2.8.5 PYSEC-2026-2393
2.1.0 - 2.8.5 PYSEC-2026-2393
Low Risk
3 months ago
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
Low Risk
3 months ago
No summary available
2.3.1 - 2.8.6 PYSEC-2026-3719
2.3.1 - 2.8.6 PYSEC-2026-3719
Impacted packages
Timeline
Published
3 months ago
July 13, 2026 at 03:46 PM UTC
Fixed (2.8.5)
4 months ago
June 16, 2026 at 10:58 PM UTC
Last Modified
3 months ago
July 13, 2026 at 04:31 PM UTC